Event ID 4873 — Node Membership in Cluster

  • Article

Applies To: Windows Server 2008 R2

Failover cluster nodes must have the ability to start the Cluster service, form a cluster (when a given node starts but no other nodes are up) and join a cluster (when a given node starts and discovers that one or more nodes are already up). This requires that certain conditions be met, for example, failover cluster nodes must run compatible versions of the operating system.

Event Details

Product: Windows Operating System
ID: 4873
Source: Microsoft-Windows-FailoverClustering
Version: 6.1
Symbolic Name: NETFT_CLUSSVC_TERMINATE_BECAUSE_OF_WATCHDOG
Message: The cluster service has detected that the failover cluster virtual adapter has stopped. This is expected when hot replace CPU is performed on this node. Cluster service will stop and should automatically restart after the operation is complete. Please check for additional events associated with the service and ensure that the cluster service has been restarted on this node.

Resolve

Review sequence of events leading to eviction of a cluster node

A node was evicted from the cluster. If you are not sure why, review the sequence of logged events before the eviction. If you do not currently have Event Viewer open, see "Opening Event Viewer and viewing events related to failover clustering." In Event Viewer, look for the following information:

  • One or more events that indicate that the node failed an attempt to join the cluster. These events might include a status code that contains more information.
  • An event that indicates that the node was evicted intentionally. If you do not know who evicted the node and want to collect such information in the future, you can configure auditing of attempts to access the cluster. To do this, first configure organization-wide auditing settings, then follow the instructions in "Enabling auditing of a cluster after auditing has been configured in your organization," later in this topic.

After correcting a problem on a node, if necessary, restart the Cluster service on the node. For more information, see "Restarting the Cluster service after correcting a problem on a node," later in this topic.

To perform the following procedures, you must be a member of the local Administrators group on each clustered server, and the account you use must be a domain account, or you must have been delegated the equivalent authority.

Restarting the Cluster service after correcting a problem on a node

To restart the Cluster service after correcting a problem on a node:

  1. To open the failover cluster snap-in, click Start, click Administrative Tools, and then click Failover Cluster Management. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
  2. In the Failover Cluster Management snap-in, if the cluster you want to manage is not displayed, in the console tree, right-click Failover Cluster Management, click Manage a Cluster, and then select or specify the cluster that you want.
  3. If the console tree is collapsed, expand the tree under the cluster you want to manage.
  4. Expand the console tree under Nodes.
  5. Right-click the node that you want to start and then click More Actions. If Stop Cluster Service is available, click it. Otherwise, skip to the next step.
  6. Right-click the node that you want to start, click More Actions, and then click Start Cluster Service.

Enabling auditing of a cluster after auditing has been configured in your organization

To enable auditing of a cluster after auditing has been configured in your organization:

  1. To open the failover cluster snap-in, click Start, click Administrative Tools, and then click Failover Cluster Management. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
  2. In the Failover Cluster Management snap-in, if the cluster you want to manage is not displayed, in the console tree, right-click Failover Cluster Management, click Manage a Cluster, and then select or specify the cluster that you want.
  3. Right-click the cluster, click Properties, and then click the Cluster Permissions tab.
  4. Click the Advanced button, and then click Auditing.
  5. Specify the users or groups that you want to audit in the same way that you would for other resources.

To open Event Viewer and view events related to failover clustering:

  1. If Server Manager is not already open, click Start, click Administrative Tools, and then click Server Manager. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
  2. In the console tree, expand Diagnostics, expand Event Viewer, expand Windows Logs, and then click System.
  3. To filter the events so that only events with a Source of FailoverClustering are shown, in the Actions pane, click Filter Current Log. On the Filter tab, in the Event sources box, select FailoverClustering. Select other options as appropriate, and then click OK.
  4. To sort the displayed events by date and time, in the center pane, click the Date and Time column heading.

Verify

To perform this procedure, you must be a member of the local Administrators group on each clustered server, and the account you use must be a domain account, or you must have been delegated the equivalent authority.

Verifying that the Cluster service is started on all the nodes in a failover cluster

To verify that the Cluster service is started on all the nodes in a failover cluster:

  1. To open the failover cluster snap-in, click Start, click Administrative Tools, and then click Failover Cluster Management. If the User Account Control dialog box appears, confirm that the action it displays is what you want, and then click Continue.
  2. In the Failover Cluster Management snap-in, if the cluster you want to manage is not displayed, in the console tree, right-click Failover Cluster Management, click Manage a Cluster, and then select or specify the cluster that you want.
  3. If the console tree is collapsed, expand the tree under the cluster you want to manage, and then click Nodes.
  4. View the status for each node. If a node is Up, the Cluster service is started on that node.

Another way to check whether the Cluster service is started is to run a command on a node in the cluster.

Using a command to check whether the Cluster service is started on a node

To use a command to check whether the Cluster service is started on a node:

  1. On the node that you are checking, click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.

  2. Type:

    CLUSTER NODE /STATUS

    If the node status is Up, the Cluster service is started on that node.

Node Membership in Cluster

Failover Clustering